Re: [keycloak-dev] Direct grant always on
IMO it's needed by default and shouldn't be an extra config option.
OAuth2 spec says to limit it's use yes, but that's so there's less passwords
flying around. Problem is that spec only provides a good solution for web and nothing
else. So for CLIs (and even some native apps) you're left with using
username+password.
Initially it was disabled by default as we thought there was some security implications.
However, given a users username and password someone can just the same endpoints as the
web based login does. They do pretty much the same thing when invoked from a script, just
less user friendly. I.e. curl ../openid-connect/login, scrape the csrf protection value,
post it with username and password, then crab the code from the redirect. Anyone that has
access to swap the code for the token, would also have access to invoking the direct grant
endpoint.
----- Original Message -----
From: "Marek Posolda" <mposolda(a)redhat.com>
To: "Stian Thorgersen" <stian(a)redhat.com>, "keycloak dev"
<keycloak-dev(a)lists.jboss.org>
Sent: Tuesday, 2 June, 2015 4:19:41 PM
Subject: Re: [keycloak-dev] Direct grant always on
Maybe we can have it "true" by default, as it will likely save a lot of
pain to many people. However I would not remove it as at least OAuth2
specs doesn't like it very well (Especially see 10.7
https://tools.ietf.org/html/rfc6749#page-57 ).
Maybe better alternative is to have the possibility to enable it for
master realm with something like the keycloak-bootstrap.json file, which
was planned to be added at some point (or maybe even have the option in
keycloak-server.json) ?
Marek
On 2.6.2015 15:04, Stian Thorgersen wrote:
> I propose we remove the option to enable/disable direct grant and always
> have it on. Alternatively we need an option to enable it without using the
> admin console.
>
> This is for users that want to use a CLI, or needs to do some automatic
> configuration when provisioning a KC.
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev